FDO Access Control Using FDO Operations

Abstract

The FDO Requirement Specification Version 3.0 [1] general requirement 9 (FDO-GR-9) states that each FDO can have metadata of different types such as access permissions.  FDO access permissions is a potentially complex aspect of FDOs:  A simple text license could be sufficient for some FDOs, but others may need more restrictive and configurable forms of access controls.  While FDOs should be ultimately findable, accessible, interoperable and reusable, some may not want to be accessible by all nor for free.  Moreover, some repository managers may only make their objects accessible as FDOs on the condition that they retain full control over the access control methodology, and can restrict who can access them and under which conditions.

The FDO Requirement Specification Version 3.0 specifications do not specify any particular access control operations but the FDO Specification General Requirement 6 (FDO-GR6) suggests that application extensible FDO Operations could be used for that purpose.  We call an FDO Operation that enforce an FDO’s access control an FDO Access Control Operation.  Since it is an FDO operation, an FDO Access Control Operation is intrinsically FAIR and can offer a wide and extensible range of different types of access controls.

While the complete details of FDO Access Control Operations not explicitly specified in the FDO Requirements specifications, much of these concepts are described in the DOIPV2.0 [3] protocol and can be directly applied to the FDO space in an implementation neutral manner.